> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/martin-ratti/PCFIX-Baru/llms.txt
> Use this file to discover all available pages before exploring further.

# Password Reset

> Request and complete password reset flow

The password reset functionality is split into two endpoints: one to request a reset token and another to actually reset the password.

## Request Password Reset

```
POST /api/auth/forgot-password
```

Initiates the password reset process by sending a reset token to the user's email address.

### Request Body

<ParamField body="email" type="string" required>
  User's email address. Must be a valid email format.
</ParamField>

### Response

<ResponseField name="success" type="boolean">
  Indicates whether the request was successful.
</ResponseField>

<ResponseField name="data" type="object">
  <Expandable title="data properties">
    <ResponseField name="message" type="string">
      Confirmation message (always returns success for security reasons, even if email doesn't exist).
    </ResponseField>
  </Expandable>
</ResponseField>

### Status Codes

<ResponseField name="200" type="Success">
  Request processed successfully.
</ResponseField>

<ResponseField name="400" type="Bad Request">
  Invalid email format.
</ResponseField>

### Example Request

```bash cURL theme={null}
curl -X POST https://api.pcfix.com/api/auth/forgot-password \
  -H "Content-Type: application/json" \
  -d '{
    "email": "usuario@ejemplo.com"
  }'
```

```javascript JavaScript theme={null}
const response = await fetch('https://api.pcfix.com/api/auth/forgot-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    email: 'usuario@ejemplo.com'
  })
});

const data = await response.json();
console.log(data);
```

### Example Response

```json theme={null}
{
  "success": true,
  "data": {
    "message": "Correo enviado"
  }
}
```

### Notes

* The reset token is valid for 1 hour (3600 seconds)
* An email with the reset link is sent asynchronously
* For security reasons, the response is always successful even if the email doesn't exist
* The token is a 32-byte random hex string

***

## Reset Password

```
POST /api/auth/reset-password
```

Completes the password reset process using the token received via email.

### Request Body

<ParamField body="token" type="string" required>
  The reset token received via email.
</ParamField>

<ParamField body="newPassword" type="string" required>
  The new password. Must be at least 6 characters long.
</ParamField>

### Response

<ResponseField name="success" type="boolean">
  Indicates whether the request was successful.
</ResponseField>

<ResponseField name="data" type="object">
  <Expandable title="data properties">
    <ResponseField name="message" type="string">
      Confirmation message.
    </ResponseField>
  </Expandable>
</ResponseField>

### Status Codes

<ResponseField name="200" type="Success">
  Password reset successful.
</ResponseField>

<ResponseField name="400" type="Bad Request">
  Invalid token, expired token, or validation error.
</ResponseField>

### Error Response

```json theme={null}
{
  "success": false,
  "error": "Token inválido o expirado"
}
```

### Example Request

```bash cURL theme={null}
curl -X POST https://api.pcfix.com/api/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{
    "token": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "newPassword": "nuevaPassword123"
  }'
```

```javascript JavaScript theme={null}
const response = await fetch('https://api.pcfix.com/api/auth/reset-password', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    token: resetToken,
    newPassword: 'nuevaPassword123'
  })
});

const data = await response.json();
console.log(data);
```

```python Python theme={null}
import requests

response = requests.post(
  'https://api.pcfix.com/api/auth/reset-password',
  json={
    'token': reset_token,
    'newPassword': 'nuevaPassword123'
  }
)

data = response.json()
print(data)
```

### Example Response

```json theme={null}
{
  "success": true,
  "data": {
    "message": "Contraseña actualizada"
  }
}
```

### Notes

* The reset token expires 1 hour after generation
* Once a password is successfully reset, the token is cleared and cannot be reused
* The new password is securely hashed using bcrypt before storage
* Both `resetToken` and `resetTokenExpires` fields are set to null after successful reset

***

## Complete Password Reset Flow

1. **User requests password reset**: Send POST request to `/api/auth/forgot-password` with email
2. **System sends email**: User receives email with reset token (valid for 1 hour)
3. **User clicks reset link**: Frontend extracts token from URL
4. **User enters new password**: Send POST request to `/api/auth/reset-password` with token and new password
5. **Password updated**: User can now log in with the new password

## Security Considerations

* Reset tokens are cryptographically secure random strings
* Tokens expire after 1 hour
* Tokens are single-use (cleared after successful reset)
* The forgot-password endpoint doesn't reveal whether an email exists in the system
* Password reset clears any existing reset tokens